@openwop/openwop-conformance 1.162.0 → 2.0.0-rc.0

package/src/scenarios/webhook-signed-delivery.test.ts

@@ -108,6 +108,7 @@ import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { discoverOwnedTenant, resolveRegistrationUrl } from '../lib/webhook-receiver.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface DeliveredRequest {
   readonly headers: Record<string, string>;
@@ -116,13 +117,13 @@ interface DeliveredRequest {
 
 async function startReceiver(): Promise<{ server: Server; url: string; received: DeliveredRequest[] }> {
   const received: DeliveredRequest[] = [];
-  const server = createServer((req: IncomingMessage, res: ServerResponse) => {
+  const server = createServer((reqBody: IncomingMessage, res: ServerResponse) => {
     const chunks: Buffer[] = [];
-    req.on('data', (c: Buffer) => chunks.push(c));
-    req.on('end', () => {
+    reqBody.on('data', (c: Buffer) => chunks.push(c));
+    reqBody.on('end', () => {
       const body = Buffer.concat(chunks).toString('utf8');
       const headers: Record<string, string> = {};
-      for (const [k, v] of Object.entries(req.headers)) {
+      for (const [k, v] of Object.entries(reqBody.headers)) {
         if (typeof v === 'string') headers[k.toLowerCase()] = v;
         else if (Array.isArray(v)) headers[k.toLowerCase()] = v.join(',');
       }
@@ -225,7 +226,7 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
       }
     }
 
-    expect(reg.status, driver.describe(
+    expect(reg.status, req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 
       'webhooks.md §"Register"',
       'POST /v1/webhooks MUST return 201 with webhookId + secret on success',
     )).toBe(201);
@@ -240,7 +241,7 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
     // what the spec shows. The postgres reference host returns both names, which
     // is why nothing went red here.
     const sub = reg.json as { webhookId: string; secret: string };
-    expect(typeof sub.webhookId, driver.describe(
+    expect(typeof sub.webhookId, req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 
       'api/openapi.yaml registerWebhook 201',
       'the 201 body MUST carry `webhookId` (required) — `subscriptionId` is not in the contract',
     )).toBe('string');
@@ -276,7 +277,7 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
     // has a subscriber; if nothing arrived HERE, the delivery went somewhere
     // this process cannot see and every assertion below it would be vacuous.
     // It fails — it must never soft-skip.
-    expect(ourDeliveries.length, driver.describe(
+    expect(ourDeliveries.length, req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 
       'webhooks.md §"Delivery"',
       registration.tunnelled
         ? 'host MUST POST at least one event for THIS run to the registered subscriber. ' +
@@ -289,7 +290,7 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
     // Validate the FIRST delivery's signature contract. Other deliveries
     // share the same signing rules; checking one is sufficient.
     const first = ourDeliveries[0]!;
-    expect(first.headers['x-openwop-signature-algorithm'], driver.describe(
+    expect(first.headers['x-openwop-signature-algorithm'], req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 
       'webhooks.md §"Signature algorithm versioning"',
       'every delivery MUST set X-openwop-Signature-Algorithm: v1',
     )).toBe('v1');
@@ -301,26 +302,26 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
     // `X-openwop-Signature: sha256={hex}`. (Suite↔spec divergence fixed 2026-08-09.)
     expect(
       first.headers['x-openwop-webhook-id'],
-      driver.describe('webhooks.md §"Delivery headers"', 'X-openwop-Webhook-Id MUST carry the subscription id'),
+      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"', 'X-openwop-Webhook-Id MUST carry the subscription id'),
     ).toBe(sub.webhookId);
 
     const timestamp = first.headers['x-openwop-timestamp'];
     expect(
       typeof timestamp === 'string' && timestamp.length > 0,
-      driver.describe('webhooks.md §"Delivery headers"', 'X-openwop-Timestamp MUST be a Unix-seconds integer string'),
+      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"', 'X-openwop-Timestamp MUST be a Unix-seconds integer string'),
     ).toBe(true);
 
     const signature = first.headers['x-openwop-signature'] ?? '';
     expect(
       signature.startsWith('sha256='),
-      driver.describe('webhooks.md §"Delivery headers"', 'X-openwop-Signature MUST carry the `sha256=` prefix'),
+      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"', 'X-openwop-Signature MUST carry the `sha256=` prefix'),
     ).toBe(true);
     const expected = createHmac('sha256', sub.secret)
       .update(`${timestamp}.${first.body}`, 'utf8')
       .digest('hex');
     expect(
       signature.replace('sha256=', ''),
-      driver.describe('webhooks.md §"Delivery headers"', 'X-openwop-Signature MUST be sha256=HMAC-SHA256(secret, `${X-openwop-Timestamp}.${rawBody}`)'),
+      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"', 'X-openwop-Signature MUST be sha256=HMAC-SHA256(secret, `${X-openwop-Timestamp}.${rawBody}`)'),
     ).toBe(expected);
 
     // RFC 0165 §C.1 — dual emission of the `OpenWOP-*` family. SHOULD-level and
@@ -337,11 +338,11 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
         ['openwop-signature', 'x-openwop-signature'],
         ['openwop-signature-algorithm', 'x-openwop-signature-algorithm'],
       ] as const) {
-        expect(first.headers[neu], driver.describe('RFC 0165 §C.1', `${neu} MUST equal ${old} when the OpenWOP-* family is emitted`)).toBe(first.headers[old]);
+        expect(first.headers[neu], req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'RFC 0165 §C.1', `${neu} MUST equal ${old} when the OpenWOP-* family is emitted`)).toBe(first.headers[old]);
       }
       expect(
         String(dual).replace('sha256=', ''),
-        driver.describe('RFC 0165 §C.1', 'OpenWOP-Signature MUST verify over the same bytes as X-openwop-Signature'),
+        req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'RFC 0165 §C.1', 'OpenWOP-Signature MUST verify over the same bytes as X-openwop-Signature'),
       ).toBe(expected);
     }
 
@@ -404,7 +405,7 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
       }
     }
 
-    expect(reg.status, driver.describe(
+    expect(reg.status, req('openwop.it.webhook-signed-delivery.control-with-a-tunnel-wired-the-host-still-refuses-the-loopback-receiver', 
       'webhooks.md §"SSRF protection"',
       'the server MUST reject loopback subscription URLs at registration time. ' +
         'It was accepted here, so this run cannot attribute the tunnelled test\'s pass to ' +

package/src/scenarios/webhook-tenant-isolation.test.ts

@@ -38,6 +38,8 @@ import { describe, it, expect } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 
@@ -66,26 +68,26 @@ async function gateOnWebhooks(): Promise<boolean> {
 describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: advertisement shape (webhooks.md)', () => {
   it('the webhooks block is either absent or carries a boolean supported flag', async () => {
     const cap = await readCapabilityFamily<WebhooksCap>('webhooks');
-    if (cap === undefined) return; // host doesn't advertise webhooks — conformant
+    if (cap === undefined) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `cap === undefined` returned early (host doesn\'t advertise webhooks — conformant)'); // host doesn't advertise webhooks — conformant
     expect(
       typeof cap.supported,
-      driver.describe('capabilities.schema.json §webhooks', 'webhooks.supported MUST be a boolean when present'),
+      req('openwop.it.webhook-tenant-isolation.the-webhooks-block-is-either-absent-or-carries-a-boolean-supported-flag', 'capabilities.schema.json §webhooks', 'webhooks.supported MUST be a boolean when present'),
     ).toBe('boolean');
   });
 });
 
 describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: two-tenant proof via the test seam (RFC 0093 §A.3)', () => {
   it('a subscription registered under tenant A is invisible to tenant B', async () => {
-    if (!(await gateOnWebhooks())) return;
+    if (!(await gateOnWebhooks())) return softSkip('blocked', 'precondition not met — `!(await gateOnWebhooks())` returned early (seam, prior step, or fixture unavailable)');
 
     const reg = await seam('tenant-a', 'register', {
       url: SAFE_URL,
       events: ['run.completed'],
     });
-    if (reg.status === 404) return; // host doesn't expose the test seam — soft-skip
-    expect(reg.status, driver.describe('RFC 0093 §A.3', 'seam register under tenant A MUST succeed')).toBe(200);
+    if (reg.status === 404) return softSkip('blocked', 'precondition not met — `reg.status === 404` returned early (host doesn\'t expose the test seam — soft-skip) (seam, prior step, or fixture unavailable)'); // host doesn't expose the test seam — soft-skip
+    expect(reg.status, req('openwop.it.webhook-tenant-isolation.a-subscription-registered-under-tenant-a-is-invisible-to-tenant-b', 'RFC 0093 §A.3', 'seam register under tenant A MUST succeed')).toBe(200);
     const webhookId = (reg.json as { webhookId?: string }).webhookId;
-    expect(typeof webhookId, 'seam register MUST return the new webhookId').toBe('string');
+    expect(typeof webhookId, req('openwop.it.webhook-tenant-isolation.a-subscription-registered-under-tenant-a-is-invisible-to-tenant-b', 'RFC 0093 §A.3', 'seam register MUST return the new webhookId')).toBe('string');
 
     try {
       const listB = await seam('tenant-b', 'list', {});
@@ -94,7 +96,7 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: two-tenant proof via the t
         .map((w) => w.webhookId);
       expect(
         idsB,
-        driver.describe(
+        req('openwop.it.webhook-tenant-isolation.a-subscription-registered-under-tenant-a-is-invisible-to-tenant-b', 
           'SECURITY/invariants.yaml webhook-cross-tenant-isolation',
           'tenant B MUST NOT see tenant A subscriptions in its list',
         ),
@@ -105,7 +107,7 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: two-tenant proof via the t
         .map((w) => w.webhookId);
       expect(
         idsA,
-        driver.describe('RFC 0093 §A.3', 'tenant A MUST see its own subscription (same-tenant control)'),
+        req('openwop.it.webhook-tenant-isolation.a-subscription-registered-under-tenant-a-is-invisible-to-tenant-b', 'RFC 0093 §A.3', 'tenant A MUST see its own subscription (same-tenant control)'),
       ).toContain(webhookId);
     } finally {
       await seam('tenant-a', 'unregister', { webhookId });
@@ -115,7 +117,7 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: two-tenant proof via the t
 
 describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: black-box registration-surface scoping (webhooks.md)', () => {
   it('registering under a tenant the caller is not a member of is refused', async () => {
-    if (!(await gateOnWebhooks())) return;
+    if (!(await gateOnWebhooks())) return softSkip('blocked', 'precondition not met — `!(await gateOnWebhooks())` returned early (seam, prior step, or fixture unavailable)');
 
     const foreignTenant = `openwop-conformance-foreign-${uniqueSuffix()}`;
     const reg = await driver.post('/v1/webhooks', {
@@ -135,7 +137,7 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: black-box registration-sur
     }
     expect(
       reg.status,
-      driver.describe(
+      req('openwop.it.webhook-tenant-isolation.registering-under-a-tenant-the-caller-is-not-a-member-of-is-refused', 
         'webhooks.md §Endpoints ("the caller MUST be a member of the tenant") + RFC 0093 §A.3',
         'registration under a tenant the caller is not a member of MUST be refused (403/404/400), never 201',
       ),
@@ -143,7 +145,7 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: black-box registration-sur
   });
 
   it('a held subscription cannot be unregistered through a foreign tenant scope', async () => {
-    if (!(await gateOnWebhooks())) return;
+    if (!(await gateOnWebhooks())) return softSkip('blocked', 'precondition not met — `!(await gateOnWebhooks())` returned early (seam, prior step, or fixture unavailable)');
 
     // Register under the caller's own tenant (host defaults the scope from
     // the API key when tenantId is omitted — the same registration shape the
@@ -159,10 +161,10 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: black-box registration-sur
       console.warn(
         `[webhook-tenant-isolation] could not register a probe subscription (${reg.status}); skipping foreign-unregister leg`,
       );
-      return;
+      return softSkip('blocked', 'precondition not met — `reg.status !== 201` returned early ([webhook-tenant-isolation] could not register a probe subscription (…); skipping foreign-unregister leg) (seam, prior step, or fixture unavailable)');
     }
     const webhookId = (reg.json as { webhookId?: string }).webhookId;
-    expect(typeof webhookId, 'registration MUST return webhookId').toBe('string');
+    expect(typeof webhookId, req('openwop.it.webhook-tenant-isolation.a-held-subscription-cannot-be-unregistered-through-a-foreign-tenant-scope', 'webhooks.md §Unregister (403 non-member / 404 not-in-scope) + RFC 0093 §A.3', 'registration MUST return webhookId')).toBe('string');
 
     try {
       const foreignTenant = `openwop-conformance-foreign-${uniqueSuffix()}`;
@@ -171,7 +173,7 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: black-box registration-sur
       );
       expect(
         del.status !== 204 && del.status < 500,
-        driver.describe(
+        req('openwop.it.webhook-tenant-isolation.a-held-subscription-cannot-be-unregistered-through-a-foreign-tenant-scope', 
           'webhooks.md §Unregister (403 non-member / 404 not-in-scope) + RFC 0093 §A.3',
           `unregister through a foreign tenant scope MUST NOT succeed (got ${del.status})`,
         ),

package/src/scenarios/workflow-chain-deferred-parameters.test.ts

@@ -50,6 +50,8 @@ import {
   type WorkflowChain,
   type DeferredExpansionContext,
 } from '../lib/workflow-chain-expansion.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const CAPS = join(SCHEMAS_DIR, 'capabilities.schema.json');
 const MANIFEST = join(SCHEMAS_DIR, 'workflow-chain-pack-manifest.schema.json');
@@ -59,10 +61,6 @@ const MANIFEST = join(SCHEMAS_DIR, 'workflow-chain-pack-manifest.schema.json');
 // repo-layout only: `null` in the published layout and skipped, never thrown.
 const CHAIN_DOC: string | null = V1_DIR === null ? null : join(V1_DIR, 'workflow-chain-packs.md');
 
-/** Spec-cited assertion message. Unlike `driver.describe`, this does NOT load
- *  env, so it is safe in always-on server-free legs (no OPENWOP_BASE_URL). */
-const cite = (section: string, requirement: string): string => `${section} — ${requirement}`;
-
 const resolvable = () => true;
 const HOST_FULL = { promptVariableSource: true, secretsSupported: true };
 
@@ -112,13 +110,13 @@ describe('workflow-chain-deferred: non-sensitive deferral (server-free, RFC 0124
 
     expect(
       hasResidualToken({ nodes: out.nodes, edges: out.edges }),
-      cite('workflow-chain-packs.md §Deferred-parameter expansion', 'the persisted fragment MUST contain zero {{params.*}} tokens (R3 portability)'),
+      req('openwop.it.workflow-chain-deferred-parameters.materializes-variables-with-defaultvalue-type-and-leaves-zero-params-tokens-r3', 'workflow-chain-packs.md §Deferred-parameter expansion', 'the persisted fragment MUST contain zero {{params.*}} tokens (R3 portability)'),
     ).toBe(false);
 
     const topicVar = out.variables.find((v) => v.name === 'topic');
-    expect(topicVar, 'topic MUST be materialized as a top-level variable').toBeDefined();
-    expect(topicVar!.defaultValue, 'author input becomes defaultValue').toBe('sales');
-    expect(topicVar!.type, 'type copied from the parameter schema').toBe('string');
+    expect(topicVar, req('openwop.it.workflow-chain-deferred-parameters.materializes-variables-with-defaultvalue-type-and-leaves-zero-params-tokens-r3', 'workflow-chain-packs.md', 'topic MUST be materialized as a top-level variable')).toBeDefined();
+    expect(topicVar!.defaultValue, req('openwop.it.workflow-chain-deferred-parameters.materializes-variables-with-defaultvalue-type-and-leaves-zero-params-tokens-r3', 'workflow-chain-packs.md', 'author input becomes defaultValue')).toBe('sales');
+    expect(topicVar!.type, req('openwop.it.workflow-chain-deferred-parameters.materializes-variables-with-defaultvalue-type-and-leaves-zero-params-tokens-r3', 'workflow-chain-packs.md', 'type copied from the parameter schema')).toBe('string');
 
     // prompt token → {{varName}} + source:"variable"
     expect((out.nodes[0].config as { systemPrompt: string }).systemPrompt).toBe('Hello {{topic}}');
@@ -133,7 +131,7 @@ describe('workflow-chain-deferred: non-sensitive deferral (server-free, RFC 0124
     const out = expandChainDeferred(c, deferCtx({ count: 5 }, c.parameters as never));
     expect(
       out.nodes[0].inputs!.limit,
-      cite('workflow-chain-packs.md §Deferred-parameter expansion', 'a whole-value {{params.x}} input rewrites to a variable-sourced PortValue, not a stringified token'),
+      req('openwop.it.workflow-chain-deferred-parameters.a-whole-value-input-token-becomes-a-variable-sourced-portvalue-wcp2-raw-typed', 'workflow-chain-packs.md §Deferred-parameter expansion', 'a whole-value {{params.x}} input rewrites to a variable-sourced PortValue, not a stringified token'),
     ).toEqual({ source: 'variable', variable: 'count' });
   });
 
@@ -145,7 +143,7 @@ describe('workflow-chain-deferred: non-sensitive deferral (server-free, RFC 0124
     const out = expandChainDeferred(c, deferCtx({ topic: 't' }, c.parameters as never));
     expect(
       out.configurableSchema.properties.topic,
-      cite('workflow-chain-packs.md §Override key + variable naming', 'the bare parameter name is the normative override key'),
+      req('openwop.it.workflow-chain-deferred-parameters.the-bare-param-name-is-the-override-key-in-the-auto-generated-configurableschema', 'workflow-chain-packs.md §Override key + variable naming', 'the bare parameter name is the normative override key'),
     ).toEqual({ type: 'string' });
   });
 });
@@ -162,14 +160,14 @@ describe('workflow-chain-deferred: §Security sensitive-parameter MUSTs (server-
 
     expect(
       out.promptVariables.find((p) => p.name === 'apiKey')?.source,
-      cite('workflow-chain-packs.md §Security', 'a sensitive prompt-body param MUST bind source:"secret" (not source:"variable")'),
+      req('openwop.it.workflow-chain-deferred-parameters.a-sensitive-param-in-a-prompt-body-materializes-as-source-secret-no-plaintext-de', 'workflow-chain-packs.md §Security', 'a sensitive prompt-body param MUST bind source:"secret" (not source:"variable")'),
     ).toBe('secret');
     // The plaintext secret MUST appear NOWHERE — not as a variable defaultValue, not in the fragment.
     expect(
       JSON.stringify(out).includes('sk-PLAINTEXT-SECRET'),
-      cite('workflow-chain-packs.md §Security', 'the sensitive value MUST NOT be materialized into variables[] or the persisted fragment (never bagged, SR-1)'),
+      req('openwop.it.workflow-chain-deferred-parameters.a-sensitive-param-in-a-prompt-body-materializes-as-source-secret-no-plaintext-de', 'workflow-chain-packs.md §Security', 'the sensitive value MUST NOT be materialized into variables[] or the persisted fragment (never bagged, SR-1)'),
     ).toBe(false);
-    expect(out.variables.find((v) => v.name === 'apiKey'), 'sensitive param is NOT a plaintext top-level variable').toBeUndefined();
+    expect(out.variables.find((v) => v.name === 'apiKey'), req('openwop.it.workflow-chain-deferred-parameters.a-sensitive-param-in-a-prompt-body-materializes-as-source-secret-no-plaintext-de', 'workflow-chain-packs.md', 'sensitive param is NOT a plaintext top-level variable')).toBeUndefined();
   });
 
   it('a sensitive param in a whole-value node.input FAILS CLOSED (sensitive_param_not_deferrable, 422)', () => {
@@ -183,10 +181,10 @@ describe('workflow-chain-deferred: §Security sensitive-parameter MUSTs (server-
     } catch (e) {
       err = e;
     }
-    expect(err, 'a sensitive whole-value input MUST throw, not defer').toBeInstanceOf(SensitiveParamNotDeferrableError);
+    expect(err, req('openwop.it.workflow-chain-deferred-parameters.a-sensitive-param-in-a-whole-value-node-input-fails-closed-sensitive-param-not-d', 'workflow-chain-packs.md', 'a sensitive whole-value input MUST throw, not defer')).toBeInstanceOf(SensitiveParamNotDeferrableError);
     expect(
       (err as SensitiveParamNotDeferrableError).code,
-      cite('workflow-chain-packs.md §Security', 'a sensitive param outside a prompt body MUST fail closed with sensitive_param_not_deferrable'),
+      req('openwop.it.workflow-chain-deferred-parameters.a-sensitive-param-in-a-whole-value-node-input-fails-closed-sensitive-param-not-d', 'workflow-chain-packs.md §Security', 'a sensitive param outside a prompt body MUST fail closed with sensitive_param_not_deferrable'),
     ).toBe('sensitive_param_not_deferrable');
     expect((err as SensitiveParamNotDeferrableError).httpStatus).toBe(422);
   });
@@ -204,7 +202,7 @@ describe('workflow-chain-deferred: §Security sensitive-parameter MUSTs (server-
     }
     expect(
       err,
-      cite('workflow-chain-packs.md §Security', 'a host lacking capabilities.secrets MUST NOT plaintext-defer a sensitive param — fail closed'),
+      req('openwop.it.workflow-chain-deferred-parameters.a-sensitive-prompt-body-param-on-a-host-without-secrets-support-fails-closed-422', 'workflow-chain-packs.md §Security', 'a host lacking capabilities.secrets MUST NOT plaintext-defer a sensitive param — fail closed'),
     ).toBeInstanceOf(SensitiveParamNotDeferrableError);
   });
 
@@ -219,7 +217,7 @@ describe('workflow-chain-deferred: §Security sensitive-parameter MUSTs (server-
     );
     // Fallback resolves the token at expansion time — no {{topic}} slot, value inlined, still zero {{params.*}}.
     expect((out.nodes[0].config as { systemPrompt: string }).systemPrompt).toBe('Hi sales');
-    expect(hasResidualToken({ nodes: out.nodes }), 'no residual {{params.*}} even on the fallback path').toBe(false);
+    expect(hasResidualToken({ nodes: out.nodes }), req('openwop.it.workflow-chain-deferred-parameters.negative-capability-no-prompts-variable-source-prompt-token-falls-back-to-expans', 'workflow-chain-packs.md', 'no residual {{params.*}} even on the fallback path')).toBe(false);
   });
 });
 
@@ -227,29 +225,29 @@ describe('workflow-chain-deferred: schema + spec surface (always-on, server-free
   it('capabilities.schema.json §workflowChainPacks.deferredParameters requires supported:boolean', () => {
     const raw = readFileSync(CAPS, 'utf8');
     // The deferredParameters block MUST parse as part of the capabilities schema.
-    expect(() => JSON.parse(raw), 'capabilities.schema.json MUST be valid JSON').not.toThrow();
-    expect(raw.includes('"deferredParameters"'), 'the deferredParameters capability block MUST exist').toBe(true);
+    expect(() => JSON.parse(raw), req('openwop.it.workflow-chain-deferred-parameters.capabilities-schema-json-workflowchainpacks-deferredparameters-requires-supporte', 'workflow-chain-packs.md', 'capabilities.schema.json MUST be valid JSON')).not.toThrow();
+    expect(raw.includes('"deferredParameters"'), req('openwop.it.workflow-chain-deferred-parameters.capabilities-schema-json-workflowchainpacks-deferredparameters-requires-supporte', 'workflow-chain-packs.md', 'the deferredParameters capability block MUST exist')).toBe(true);
     expect(
       raw.includes('sensitive_param_not_deferrable'),
-      cite('capabilities.schema.json §deferredParameters', 'the capability description MUST reference the fail-closed sensitive rule'),
+      req('openwop.it.workflow-chain-deferred-parameters.capabilities-schema-json-workflowchainpacks-deferredparameters-requires-supporte', 'capabilities.schema.json §deferredParameters', 'the capability description MUST reference the fail-closed sensitive rule'),
     ).toBe(true);
   });
 
   it('workflow-chain-pack-manifest.schema.json documents x-openwop-sensitive with the source:"secret" MUST', () => {
     const raw = readFileSync(MANIFEST, 'utf8');
-    expect(raw.includes('x-openwop-sensitive'), 'the manifest schema MUST recognize x-openwop-sensitive').toBe(true);
+    expect(raw.includes('x-openwop-sensitive'), req('openwop.it.workflow-chain-deferred-parameters.workflow-chain-pack-manifest-schema-json-documents-x-openwop-sensitive-with-the', 'workflow-chain-packs.md', 'the manifest schema MUST recognize x-openwop-sensitive')).toBe(true);
     expect(
       raw.includes('source:"secret"') || raw.includes('source:\\"secret\\"'),
-      cite('workflow-chain-pack-manifest.schema.json', 'the x-openwop-sensitive description MUST reflect the amended source:"secret" MUST, not the stale plaintext-variable wording'),
+      req('openwop.it.workflow-chain-deferred-parameters.workflow-chain-pack-manifest-schema-json-documents-x-openwop-sensitive-with-the', 'workflow-chain-pack-manifest.schema.json', 'the x-openwop-sensitive description MUST reflect the amended source:"secret" MUST, not the stale plaintext-variable wording'),
     ).toBe(true);
   });
 
   it.skipIf(CHAIN_DOC === null)('the spec pins the error code + the per-run credentialRef (not plaintext) supply shape', () => {
     const spec = readFileSync(CHAIN_DOC as string, 'utf8');
-    expect(spec.includes('sensitive_param_not_deferrable'), 'error code MUST be documented').toBe(true);
+    expect(spec.includes('sensitive_param_not_deferrable'), req('openwop.it.workflow-chain-deferred-parameters.the-spec-pins-the-error-code-the-per-run-credentialref-not-plaintext-supply-shap', 'workflow-chain-packs.md', 'error code MUST be documented')).toBe(true);
     expect(
       spec.includes('credentialRef'),
-      cite('workflow-chain-packs.md §Security', 'per-run supply of a sensitive param MUST be a credentialRef, not plaintext'),
+      req('openwop.it.workflow-chain-deferred-parameters.the-spec-pins-the-error-code-the-per-run-credentialref-not-plaintext-supply-shap', 'workflow-chain-packs.md §Security', 'per-run supply of a sensitive param MUST be a credentialRef, not plaintext'),
     ).toBe(true);
   });
 });
@@ -265,20 +263,20 @@ describe('workflow-chain-deferred: host behavior (capability-gated, RFC 0124)',
       override: { topic: 'run-topic' },
       fork: true,
     });
-    if (res.status === 404 || res.status === 403) return; // seam unwired — soft-skip
+    if (res.status === 404 || res.status === 403) return softSkip('blocked', 'precondition not met — `res.status === 404 || res.status === 403` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
 
     const body = res.json as { resolved?: string; forkResolved?: string; contentTrust?: string } | undefined;
     expect(
       body?.resolved,
-      cite('workflow-chain-packs.md §Deferred-parameter expansion', 'a bare-param configurable override rebinds the resolved value'),
+      req('openwop.it.workflow-chain-deferred-parameters.a-deferred-round-trip-bare-param-configurable-override-changes-the-value-fork-re', 'workflow-chain-packs.md §Deferred-parameter expansion', 'a bare-param configurable override rebinds the resolved value'),
     ).toBe('run-topic');
     expect(
       body?.forkResolved,
-      cite('replay.md §Determinism', ':fork replays the same bound value (RunSnapshot.variables byte-equivalence, R4)'),
+      req('openwop.it.workflow-chain-deferred-parameters.a-deferred-round-trip-bare-param-configurable-override-changes-the-value-fork-re', 'replay.md §Determinism', ':fork replays the same bound value (RunSnapshot.variables byte-equivalence, R4)'),
     ).toBe('run-topic');
     expect(
       body?.contentTrust,
-      cite('workflow-chain-packs.md §Deferred-parameter expansion step 4', 'a deferred-variable prompt binding composes contentTrust:"untrusted" (R1)'),
+      req('openwop.it.workflow-chain-deferred-parameters.a-deferred-round-trip-bare-param-configurable-override-changes-the-value-fork-re', 'workflow-chain-packs.md §Deferred-parameter expansion step 4', 'a deferred-variable prompt binding composes contentTrust:"untrusted" (R1)'),
     ).toBe('untrusted');
   });
 
@@ -291,12 +289,12 @@ describe('workflow-chain-deferred: host behavior (capability-gated, RFC 0124)',
       sensitiveParam: 'apiKey',
       credentialRef: 'cred-123',
     });
-    if (res.status === 404 || res.status === 403) return; // seam unwired — soft-skip
+    if (res.status === 404 || res.status === 403) return softSkip('blocked', 'precondition not met — `res.status === 404 || res.status === 403` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
 
     const body = res.json as { composed?: string } | undefined;
     expect(
       body?.composed?.includes('[REDACTED'),
-      cite('workflow-chain-packs.md §Security', 'a source:"secret" sensitive var MUST redact to [REDACTED:<credentialRef>] in prompt.composed'),
+      req('openwop.it.workflow-chain-deferred-parameters.a-sensitive-param-composes-as-redacted-credentialref-and-the-plaintext-appears-n', 'workflow-chain-packs.md §Security', 'a source:"secret" sensitive var MUST redact to [REDACTED:<credentialRef>] in prompt.composed'),
     ).toBe(true);
   });
 });

package/src/scenarios/workflow-chain-expansion.test.ts

@@ -34,6 +34,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { expandChain, type WorkflowChain } from '../lib/workflow-chain-expansion.js';
+import { req } from '../lib/requirement-ids.js';
 
 /** Index helper that narrows away the `T | undefined` from `noUncheckedIndexedAccess`
  *  with an actionable error message — replaces `arr[i]!` non-null assertions so a
@@ -95,7 +96,7 @@ describe('category: workflow-chain expansion — placeholder substitution', () =
     const config = at(fragment.nodes, 0, 'fragment.nodes').config as { systemPrompt: string };
     expect(
       config.systemPrompt,
-      'Per workflow-chain-packs.md §"Parameter substitution": placeholders MUST be substituted literally at expansion time.',
+      req('openwop.it.workflow-chain-expansion.substitutes-params-x-placeholders-literally-in-config-strings', 'workflow-chain-packs.md', 'Per workflow-chain-packs.md §"Parameter substitution": placeholders MUST be substituted literally at expansion time.'),
     ).toBe('Write a PRD for: AI-powered toaster\nAudience: restaurant chains');
   });
 
@@ -130,11 +131,11 @@ describe('category: workflow-chain expansion — placeholder substitution', () =
     };
     expect(
       config.outer.middle.message,
-      'Recursive substitution MUST walk into nested objects (per spec §Parameter substitution: "Substitution MUST recurse into nested string values within `config` and `inputs`").',
+      req('openwop.it.workflow-chain-expansion.recurses-into-nested-object-structures-in-config', 'workflow-chain-packs.md', 'Recursive substitution MUST walk into nested objects (per spec §Parameter substitution: "Substitution MUST recurse into nested string values within `config` and `inputs`").'),
     ).toBe('Hello world');
     expect(
       config.outer.middle.tags,
-      'Recursive substitution MUST also walk into array elements when those elements are strings.',
+      req('openwop.it.workflow-chain-expansion.recurses-into-nested-object-structures-in-config', 'workflow-chain-packs.md', 'Recursive substitution MUST also walk into array elements when those elements are strings.'),
     ).toEqual(['static', 'world-tag']);
   });
 
@@ -156,7 +157,7 @@ describe('category: workflow-chain expansion — placeholder substitution', () =
       { expansionId: 'x', params: {}, isTypeIdResolvable: RESOLVE_ALL },
     );
     const config = at(fragment.nodes, 0, 'fragment.nodes').config as { literal: string; empty: string };
-    expect(config.literal).toBe('no placeholders here');
+    expect(config.literal, req('openwop.it.workflow-chain-expansion.leaves-non-placeholder-strings-untouched', 'workflow-chain-packs.md', 'leaves non-placeholder strings untouched')).toBe('no placeholders here');
     expect(config.empty).toBe('');
   });
 
@@ -178,7 +179,7 @@ describe('category: workflow-chain expansion — placeholder substitution', () =
       { expansionId: 'x', params: { who: 'Ada' }, isTypeIdResolvable: RESOLVE_ALL },
     );
     const config = at(fragment.nodes, 0, 'fragment.nodes').config as { a: string; b: string; joined: string };
-    expect(config.a).toBe('Ada');
+    expect(config.a, req('openwop.it.workflow-chain-expansion.substitutes-the-same-placeholder-name-in-multiple-positions', 'workflow-chain-packs.md', 'substitutes the same placeholder name in multiple positions')).toBe('Ada');
     expect(config.b).toBe('Ada');
     expect(config.joined).toBe('hi Ada, hi again Ada');
   });
@@ -231,7 +232,7 @@ describe('category: workflow-chain expansion — whole-value typed resolution',
     };
     expect(
       config.retryPolicy,
-      'Per workflow-chain-packs.md §"Parameter substitution": a value that is EXACTLY one `{{params.x}}` token MUST resolve to the raw typed value — an object param MUST NOT be stringified to "[object Object]".',
+      req('openwop.it.workflow-chain-expansion.resolves-a-whole-value-params-x-token-to-the-raw-typed-value-object-array-number', 'workflow-chain-packs.md', 'Per workflow-chain-packs.md §"Parameter substitution": a value that is EXACTLY one `{{params.x}}` token MUST resolve to the raw typed value — an object param MUST NOT be stringified to "[object Object]".'),
     ).toEqual({ attempts: 3, backoff: 'exponential' });
     expect(config.allowlist).toEqual(['a', 'b']);
     expect(config.maxTokens).toBe(4096);
@@ -255,7 +256,7 @@ describe('category: workflow-chain expansion — whole-value typed resolution',
     const config = at(fragment.nodes, 0, 'fragment.nodes').config as { label: string };
     expect(
       config.label,
-      'A token embedded in surrounding text MUST do literal string substitution (the numeric param coerces to its string form).',
+      req('openwop.it.workflow-chain-expansion.does-literal-string-coercion-for-an-embedded-token-in-surrounding-text', 'workflow-chain-packs.md', 'A token embedded in surrounding text MUST do literal string substitution (the numeric param coerces to its string form).'),
     ).toBe('items: 42');
   });
 });
@@ -290,7 +291,7 @@ describe('category: workflow-chain expansion — inputs preservation', () => {
     };
     expect(
       inputs.prompt,
-      'Per workflow-chain-packs.md §"Parameter substitution": expansion MUST preserve a present `node.inputs` (PortValue references) verbatim — only `{{params.*}}` tokens inside its string leaves are substituted.',
+      req('openwop.it.workflow-chain-expansion.preserves-a-present-node-inputs-portvalue-references-through-expansion', 'workflow-chain-packs.md', 'Per workflow-chain-packs.md §"Parameter substitution": expansion MUST preserve a present `node.inputs` (PortValue references) verbatim — only `{{params.*}}` tokens inside its string leaves are substituted.'),
     ).toEqual({ sourceNodeId: 'upstream', sourcePort: 'text' });
     expect(inputs.seed).toBe('xyz');
   });
@@ -310,7 +311,7 @@ describe('category: workflow-chain expansion — node id collision avoidance', (
     });
     expect(
       at(first.nodes, 0, 'first.nodes').id,
-      'Per spec §"Expansion semantics" step 6: each expansion MUST use a unique `expansionId` prefix so multi-expansion DAGs do not collide.',
+      req('openwop.it.workflow-chain-expansion.same-chain-expanded-twice-in-one-parent-workflow-produces-non-colliding-node-ids', 'workflow-chain-packs.md', 'Per spec §"Expansion semantics" step 6: each expansion MUST use a unique `expansionId` prefix so multi-expansion DAGs do not collide.'),
     ).not.toBe(at(second.nodes, 0, 'second.nodes').id);
     expect(at(first.nodes, 0, 'first.nodes').id).toBe('vendor_acme_generatePRD_a8f3_prd-call');
     expect(at(second.nodes, 0, 'second.nodes').id).toBe('vendor_acme_generatePRD_b9e4_prd-call');
@@ -324,7 +325,7 @@ describe('category: workflow-chain expansion — node id collision avoidance', (
     });
     expect(
       at(fragment.nodes, 0, 'fragment.nodes').id,
-      'chainId `vendor.acme.generatePRD` MUST be slugged (dots → underscores) so the resulting id is safe to use in storage backends that reserve `.` for hierarchical keys.',
+      req('openwop.it.workflow-chain-expansion.rewritten-ids-replace-dots-in-chainid-with-underscores-for-storage-key-safety', 'workflow-chain-packs.md', 'chainId `vendor.acme.generatePRD` MUST be slugged (dots → underscores) so the resulting id is safe to use in storage backends that reserve `.` for hierarchical keys.'),
     ).toMatch(/^vendor_acme_generatePRD_/);
     expect(at(fragment.nodes, 0, 'fragment.nodes').id).not.toMatch(/\./);
   });
@@ -337,7 +338,7 @@ describe('category: workflow-chain expansion — node id collision avoidance', (
     });
     expect(
       fragment.idMap.get('prd-call'),
-      'The expansion contract MUST surface the original-id → rewritten-id map so the caller can route adjacent parent-workflow edges to the right expanded node.',
+      req('openwop.it.workflow-chain-expansion.exposes-idmap-so-the-caller-can-wire-parent-workflow-edges-into-the-expansion', 'workflow-chain-packs.md', 'The expansion contract MUST surface the original-id → rewritten-id map so the caller can route adjacent parent-workflow edges to the right expanded node.'),
     ).toBe('vendor_acme_generatePRD_a8f3_prd-call');
   });
 });
@@ -367,7 +368,7 @@ describe('category: workflow-chain expansion — edge rewriting', () => {
     expect(fragment.edges).toHaveLength(1);
     expect(
       at(fragment.edges, 0, 'fragment.edges').from,
-      'Edge `from` ids that match fragment node ids MUST be rewritten with the same prefix as the nodes themselves.',
+      req('openwop.it.workflow-chain-expansion.rewrites-from-and-to-ids-that-reference-fragment-nodes', 'workflow-chain-packs.md', 'Edge `from` ids that match fragment node ids MUST be rewritten with the same prefix as the nodes themselves.'),
     ).toBe('vendor_acme_twoStep_e1_first');
     expect(at(fragment.edges, 0, 'fragment.edges').to).toBe('vendor_acme_twoStep_e1_second');
   });
@@ -387,7 +388,7 @@ describe('category: workflow-chain expansion — edge rewriting', () => {
     });
     expect(
       at(fragment.edges, 0, 'fragment.edges').from,
-      'Port-name suffix (after the `.`) MUST be preserved verbatim during id rewriting.',
+      req('openwop.it.workflow-chain-expansion.preserves-port-name-suffix-nodeid-portname-when-rewriting-edge-refs', 'workflow-chain-packs.md', 'Port-name suffix (after the `.`) MUST be preserved verbatim during id rewriting.'),
     ).toBe('vendor_acme_twoStep_e2_first.out');
     expect(at(fragment.edges, 0, 'fragment.edges').to).toBe('vendor_acme_twoStep_e2_second.in');
   });
@@ -413,7 +414,7 @@ describe('category: workflow-chain expansion — edge rewriting', () => {
     });
     expect(
       at(fragment.edges, 0, 'fragment.edges').from,
-      'Edge refs to nodes OUTSIDE the fragment MUST pass through unchanged so the parent host can wire adjacent edges post-splice.',
+      req('openwop.it.workflow-chain-expansion.leaves-edge-refs-alone-when-they-don-t-match-a-fragment-node-id', 'workflow-chain-packs.md', 'Edge refs to nodes OUTSIDE the fragment MUST pass through unchanged so the parent host can wire adjacent edges post-splice.'),
     ).toBe('parent-upstream');
     expect(at(fragment.edges, 0, 'fragment.edges').to).toBe('vendor_acme_twoStep_e3_first');
     expect(at(fragment.edges, 1, 'fragment.edges').from).toBe('vendor_acme_twoStep_e3_second');
@@ -449,11 +450,11 @@ describe('category: workflow-chain expansion — edge rewriting', () => {
     expect(edge.to).toBe('vendor_acme_twoStep_e4_second');
     expect(
       edge.condition,
-      'Per RFC 0013 amendment (2026-07-03): a present `FragmentEdge.condition` MUST be carried onto the expanded WorkflowEdge (not dropped at expansion).',
+      req('openwop.it.workflow-chain-expansion.preserves-edge-condition-and-triggerrule-onto-the-expanded-workflowedge-rfc-0013', 'RFC 0013', 'Per RFC 0013 amendment (2026-07-03): a present `FragmentEdge.condition` MUST be carried onto the expanded WorkflowEdge (not dropped at expansion).'),
     ).toEqual({ type: 'equals', left: 'status', right: 'ok' });
     expect(
       edge.triggerRule,
-      'Per RFC 0125 / workflow-chain-packs.md §"Expansion semantics": expansion MUST preserve `FragmentEdge.triggerRule` onto the resulting WorkflowEdge so the scheduler honors the fan-in / error-routing rule.',
+      req('openwop.it.workflow-chain-expansion.preserves-edge-condition-and-triggerrule-onto-the-expanded-workflowedge-rfc-0013', 'RFC 0013', 'Per RFC 0125 / workflow-chain-packs.md §"Expansion semantics": expansion MUST preserve `FragmentEdge.triggerRule` onto the resulting WorkflowEdge so the scheduler honors the fan-in / error-routing rule.'),
     ).toBe('all_complete');
   });
 
@@ -465,7 +466,7 @@ describe('category: workflow-chain expansion — edge rewriting', () => {
     });
     expect(
       at(fragment.edges, 0, 'fragment.edges').triggerRule,
-      'When a fragment edge declares no `triggerRule`, the expanded edge MUST NOT carry one — omission is identical to the `all_success` default (preserves wire-shape minimality + prior behavior).',
+      req('openwop.it.workflow-chain-expansion.omits-triggerrule-on-the-expanded-edge-when-the-fragment-edge-declares-none-defa', 'workflow-chain-packs.md', 'When a fragment edge declares no `triggerRule`, the expanded edge MUST NOT carry one — omission is identical to the `all_success` default (preserves wire-shape minimality + prior behavior).'),
     ).toBeUndefined();
   });
 });
@@ -491,7 +492,7 @@ describe('category: workflow-chain expansion — capability propagation', () =>
     for (const node of fragment.nodes) {
       expect(
         node.capabilities,
-        'Per spec §"Expansion semantics" step 8: chain-level `capabilities[]` MUST be copied to every expanded node so existing capability gates (side-effect, streamable) apply uniformly.',
+        req('openwop.it.workflow-chain-expansion.copies-chain-capabilities-into-every-expanded-node-s-capabilities', 'workflow-chain-packs.md', 'Per spec §"Expansion semantics" step 8: chain-level `capabilities[]` MUST be copied to every expanded node so existing capability gates (side-effect, streamable) apply uniformly.'),
       ).toEqual(['side-effectful', 'cacheable']);
     }
   });
@@ -504,7 +505,7 @@ describe('category: workflow-chain expansion — capability propagation', () =>
     });
     expect(
       at(fragment.nodes, 0, 'fragment.nodes').capabilities,
-      'When the chain declares no `capabilities[]`, expanded nodes MUST NOT carry an empty array (preserves wire-shape minimality).',
+      req('openwop.it.workflow-chain-expansion.omits-capabilities-on-expanded-nodes-when-the-chain-declares-none', 'workflow-chain-packs.md', 'When the chain declares no `capabilities[]`, expanded nodes MUST NOT carry an empty array (preserves wire-shape minimality).'),
     ).toBeUndefined();
   });
 });
@@ -519,7 +520,7 @@ describe('category: workflow-chain expansion — runtime-invariance contract', (
     for (const node of fragment.nodes) {
       expect(
         node.typeId,
-        'Per workflow-chain-packs.md §"What hosts dispatch": dispatching runtimes see only concrete `core.*`/published-vendor typeIds — the chain reference MUST NOT be preserved at runtime.',
+        req('openwop.it.workflow-chain-expansion.expanded-fragment-carries-only-concrete-typeids-no-chain-reference-survives', 'workflow-chain-packs.md', 'Per workflow-chain-packs.md §"What hosts dispatch": dispatching runtimes see only concrete `core.*`/published-vendor typeIds — the chain reference MUST NOT be preserved at runtime.'),
       ).not.toMatch(/^vendor\.acme\.generatePRD$/);
       expect(node.typeId).toBe('core.ai.callPrompt');
     }